Dwr in remote Xul web applications

[S.Pérès-Labourdette]

I've just packaged a new release of my portal web app including latest 2.0.5 release of Dwr.
It just runs perfectly and very fast with jawr integration.

I would like to point out engine.js changes i've done to make dwr working into a Mozilla remote Xul context so maybe someone could include it in future releases, because i think this would be great.

The only 'blocking' issue i found is in the dwr.engine._getJSessionId member which i rewrote like that

......
/** @private What is our session id? */
dwr.engine._getJSessionId =  function() {
        if (typeof document.cookie == 'undefined') { // not in a classic html context so guessing xul
                netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
                var cookieManager = Components.classes["@mozilla.org/cookiemanager;1"].getService(Components.interfaces.nsICookieManager2);
                var iter = cookieManager.enumerator;
                while (iter.hasMoreElements()) {
                        var cookie = iter.getNext();
                        if (cookie instanceof Components.interfaces.nsICookie) {
                                if (cookie.name == dwr.engine._sessionCookieName)
                                        return cookie.value;
                        }
                }
        }
        else {
                var cookies = document.cookie.split(';');
                for (var i = 0; i < cookies.length; i++) {
                        var cookie = cookies[i];
                        while (cookie.charAt(0) == ' ')
                                cookie = cookie.substring(1, cookie.length);
                        if (cookie.indexOf(dwr.engine._sessionCookieName + "=") == 0) {
                                return cookie.substring(dwr.engine._sessionCookieName.length + 1, cookie.length);
                        }
                }
        }
        return "";
}
.........


Regards,
S.PERES-LABOURDETTE

[Joe Walker-3]

Thanks for the submission.
I'm nervous about adding this to engine.js for 2 reasons:
- I want to keep it as small as possible - ideally much smaller than it is now.
- I'm concerned about the security implications of what you're doing. Is it safe to download remote scripts for execution in a chrome context?

Joe.

On Thu, Sep 11, 2008 at 11:48 AM, S.Pérès-Labourdette <sperlab@...> wrote:

I've just packaged a new release of my portal web app including latest 2.0.5
release of Dwr.
It just runs perfectly and very fast with jawr integration.

I would like to point out engine.js changes i've done to make dwr working
into a Mozilla remote Xul context so maybe someone could include it in
future releases, because i think this would be great.

The only 'blocking' issue i found is in the dwr.engine._getJSessionId member
which i rewrote like that

......
/** @private What is our session id? */
dwr.engine._getJSessionId =  function() {
       if (typeof document.cookie == 'undefined') { // not in a classic html
context so guessing xul
               netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
               var cookieManager =
Components.classes["@mozilla.org/cookiemanager;1"].getService(Components.interfaces.nsICookieManager2);
               var iter = cookieManager.enumerator;
               while (iter.hasMoreElements()) {
                       var cookie = iter.getNext();
                       if (cookie instanceof Components.interfaces.nsICookie) {
                               if (cookie.name == dwr.engine._sessionCookieName)
                                       return cookie.value;
                       }
               }
       }
       else {
               var cookies = document.cookie.split(';');
               for (var i = 0; i < cookies.length; i++) {
                       var cookie = cookies[i];
                       while (cookie.charAt(0) == ' ')
                               cookie = cookie.substring(1, cookie.length);
                       if (cookie.indexOf(dwr.engine._sessionCookieName + "=") == 0) {
                               return cookie.substring(dwr.engine._sessionCookieName.length + 1,
cookie.length);
                       }
               }
       }
       return "";
}
.........


Regards,
S.PERES-LABOURDETTE

--
View this message in context: http://www.nabble.com/Dwr-in-remote-Xul-web-applications-tp19432203p19432203.html
Sent from the DWR - Dev mailing list archive at Nabble.com.


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@...
For additional commands, e-mail: dev-help@...

[S.Pérès-Labourdette]

Hi.

This is the point. I'm doing remote xul, not a chrome-like kind of firefox extension

Thanks to mozilla's design there is no need to wonder about your concerns.

I'm not an xpcom expert, but when i was first concerned with security when designing my first remote xul app, the first thing i learned is that "chrome" vs "remote xul" is just like god vs evil.

Enabling security in remote xul app rely on firefox profile settings you can't tweak remotely such as :
 - signed.applets.codebase_principal_support
 - security.xpconnect.plugin.unrestricted
 ......

Also, most of xpcom components access is just forbidden in a "remote xul" app.

As far as i'm concerned, Direct Web "Remoting" is useful for "remote" apps and "remote" xul is definitely not chrome.

What is your point ?

Joe Walker-3 wrote:

Thanks for the submission.
I'm nervous about adding this to engine.js for 2 reasons:
- I want to keep it as small as possible - ideally much smaller than it is
now.
- I'm concerned about the security implications of what you're doing. Is it
safe to download remote scripts for execution in a chrome context?

Joe.

On Thu, Sep 11, 2008 at 11:48 AM, S.Pérès-Labourdette <[e-mail]>wrote:

>
> I've just packaged a new release of my portal web app including latest
> 2.0.5
> release of Dwr.
> It just runs perfectly and very fast with jawr integration.
>
> I would like to point out engine.js changes i've done to make dwr working
> into a Mozilla remote Xul context so maybe someone could include it in
> future releases, because i think this would be great.
>
> The only 'blocking' issue i found is in the dwr.engine._getJSessionId
> member
> which i rewrote like that
>
> ......
> /** @private What is our session id? */
> dwr.engine._getJSessionId =  function() {
>        if (typeof document.cookie == 'undefined') { // not in a classic
> html
> context so guessing xul
>
>  netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
>                var cookieManager =
> Components.classes["@mozilla.org/cookiemanager;1
> "].getService(Components.interfaces.nsICookieManager2);
>                var iter = cookieManager.enumerator;
>                while (iter.hasMoreElements()) {
>                        var cookie = iter.getNext();
>                        if (cookie instanceof
> Components.interfaces.nsICookie) {
>                                if (cookie.name ==
> dwr.engine._sessionCookieName)
>                                        return cookie.value;
>                        }
>                }
>        }
>        else {
>                var cookies = document.cookie.split(';');
>                for (var i = 0; i < cookies.length; i++) {
>                        var cookie = cookies[i];
>                        while (cookie.charAt(0) == ' ')
>                                cookie = cookie.substring(1, cookie.length);
>                        if (cookie.indexOf(dwr.engine._sessionCookieName +
> "=") == 0) {
>                                return
> cookie.substring(dwr.engine._sessionCookieName.length + 1,
> cookie.length);
>                        }
>                }
>        }
>        return "";
> }
> .........
>
>
> Regards,
> S.PERES-LABOURDETTE
>
> --
> View this message in context:
> http://www.nabble.com/Dwr-in-remote-Xul-web-applications-tp19432203p19432203.html
> Sent from the DWR - Dev mailing list archive at Nabble.com.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [e-mail]
> For additional commands, e-mail: [e-mail]
>
>

[Joe Walker-3]

Bizarrely just a couple of days ago I was investigating a Firefox plugin that did come work with cookies - I was enumerating over *all* the cookies stored by the browser with exactly the same code that you are using. I guess there is more than one nsICookieManager2?? One for Chrome apps that gives you scarey powers and one for remote XUL apps that looks like the Chrome thing but in reality is only as powerful as the browser one.

If this is right then my only objection is about code bloat and testing.

If you can help me with testing - then I'll add it in.

Please could you create a very very very small remote xul app that simply opens a new xul window, with as little decoration as possible, which automatically onload fires of a call to a hypothetical DWR method something like this:

function callOnLoad() {
  // This is a DWR method cal
  Test.doNothing(function(data) {
    dump(data);
    window.close(); // or whatever you have to do
  });
}

Thanks,

Joe.

On Sun, Sep 14, 2008 at 3:10 PM, S.Pérès-Labourdette <sperlab@...> wrote:

Hi.

This is the point. I'm doing remote xul, not a chrome-like kind of firefox
extension

Thanks to mozilla's design there is no need to wonder about your concerns.

I'm not an xpcom expert, but when i was first concerned with security when
designing my first remote xul app, the first thing i learned is that
"chrome" vs "remote xul" is just like god vs evil.

Enabling security in remote xul app rely on firefox profile settings you
can't tweak remotely such as :
 - signed.applets.codebase_principal_support
 - security.xpconnect.plugin.unrestricted
 ......

Also, most of xpcom components access is just forbidden in a "remote xul"
app.

As far as i'm concerned, Direct Web "Remoting" is useful for "remote" apps
and "remote" xul is definitely not chrome.

What is your point ?

Joe Walker-3 wrote:
>
> Thanks for the submission.
> I'm nervous about adding this to engine.js for 2 reasons:
> - I want to keep it as small as possible - ideally much smaller than it is
> now.
> - I'm concerned about the security implications of what you're doing. Is
> it
> safe to download remote scripts for execution in a chrome context?
>
> Joe.
>
> On Thu, Sep 11, 2008 at 11:48 AM, S.Pérès-Labourdette
> <sperlab@...>wrote:
>
>>
>> I've just packaged a new release of my portal web app including latest
>> 2.0.5
>> release of Dwr.
>> It just runs perfectly and very fast with jawr integration.
>>
>> I would like to point out engine.js changes i've done to make dwr working
>> into a Mozilla remote Xul context so maybe someone could include it in
>> future releases, because i think this would be great.
>>
>> The only 'blocking' issue i found is in the dwr.engine._getJSessionId
>> member
>> which i rewrote like that
>>
>> ......
>> /** @private What is our session id? */
>> dwr.engine._getJSessionId =  function() {
>>        if (typeof document.cookie == 'undefined') { // not in a classic
>> html
>> context so guessing xul
>>
>>
>> netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
>>                var cookieManager =
>> Components.classes["@mozilla.org/cookiemanager;1
>> "].getService(Components.interfaces.nsICookieManager2);
>>                var iter = cookieManager.enumerator;
>>                while (iter.hasMoreElements()) {
>>                        var cookie = iter.getNext();
>>                        if (cookie instanceof
>> Components.interfaces.nsICookie) {
>>                                if (cookie.name ==
>> dwr.engine._sessionCookieName)
>>                                        return cookie.value;
>>                        }
>>                }
>>        }
>>        else {
>>                var cookies = document.cookie.split(';');
>>                for (var i = 0; i < cookies.length; i++) {
>>                        var cookie = cookies[i];
>>                        while (cookie.charAt(0) == ' ')
>>                                cookie = cookie.substring(1,
>> cookie.length);
>>                        if (cookie.indexOf(dwr.engine._sessionCookieName +
>> "=") == 0) {
>>                                return
>> cookie.substring(dwr.engine._sessionCookieName.length + 1,
>> cookie.length);
>>                        }
>>                }
>>        }
>>        return "";
>> }
>> .........
>>
>>
>> Regards,
>> S.PERES-LABOURDETTE
>>
>> --
>> View this message in context:
>> http://www.nabble.com/Dwr-in-remote-Xul-web-applications-tp19432203p19432203.html
>> Sent from the DWR - Dev mailing list archive at Nabble.com.
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@...
>> For additional commands, e-mail: dev-help@...
>>
>>
>
>

--
View this message in context: http://www.nabble.com/Dwr-in-remote-Xul-web-applications-tp19432203p19480676.html

Sent from the DWR - Dev mailing list archive at Nabble.com.


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@...
For additional commands, e-mail: dev-help@...